Analyzing Volatile Windows Event Artifacts GCFA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   You are constructing a timeline from a memory dump. You have the following events: (1) Event ID 4624 logon at 10:00:00, (2) Event ID 4688 process creation for cmd.exe at 10:01:00, (3) Event ID 5156 network connection to an external IP at 10:02:00, and (4) Event ID 1102 Security log cleared at 10:03:00. Which sequence of events is most likely to represent an attacker's actions?

   • ANetwork connection, process creation, logon, then log clearing.
   • BLog clearing, logon, process creation, then network connection.
   • CLogon, process creation, network connection, then log clearing.
   • DProcess creation, logon, network connection, then log clearing.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   You are investigating a system where a driver failed to load. In the memory dump, you find Event ID 219 (Kernel-PnP) from the System log. Which additional event log record would best help you determine why the driver failed?

   • AEvent ID 7000 (Service Control Manager error) that indicates the driver service failed to start.
   • BEvent ID 1074 (system shutdown) to see if the system was shut down improperly.
   • CEvent ID 6005 (Event Log service started) to confirm the system boot time.
   • DEvent ID 4624 (successful logon) to see which user was logged on during the failure.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which event log is most likely to contain an error related to a third-party application crashing?

   • ASystem log
   • BSetup log
   • CSecurity log
   • DApplication log
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a common tool or plugin used to extract event log records from a Windows memory dump?

   • AFTK Imager
   • BVolatility's evtlogs plugin
   • CRegRipper
   • DWireshark
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   You are analyzing a memory dump and find an Event ID 4624 (logon) with a logon type of 2 (interactive) at 09:00:00. You also find a process (explorer.exe) with a start time of 09:00:05 and a user-association to the same account. Which conclusion is most strongly supported by correlating these artifacts?

   • AThe user's account was compromised because Explorer started immediately after the logon.
   • BThe logon event is fake because Explorer cannot start that quickly after a logon.
   • CThe user logged on over the network and then used a remote desktop tool to launch Explorer.
   • DThe user successfully logged on interactively and then launched Explorer as part of the normal shell startup.
   Reveal Solution Discussion Select an answer first